Windows Server CVE-2026-41095

Exploitation requires local, authenticated access (PR:L) to a Windows Server that has the optional Data Deduplication role enabled on one or more volumes - the vulnerable code path is not present on servers where this feature is not installed, which is the key limiting factor since Deduplication is not enabled by default. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the attacker must already possess a valid low-privilege local account or session; there is no remote or unauthenticated path. Practically, the target must be a file/storage server or similar deployment where administrators have turned on Data Deduplication.

Signals are internally consistent and point to a genuine but not urgent local EoP. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access and existing low privileges, with no user interaction and low complexity, yielding total impact - matching the SSVC 'Technical Impact: total' rating. However, SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is very low (0.04%, 13th percentile), so mass or wormable exploitation is unlikely. There is no KEV listing and no public exploit identified. Net: prioritize as part of routine monitthly patching on servers where the Deduplication role is enabled, but it is not a drop-everything emergency; the primary risk is a foothold-holding attacker escalating to SYSTEM on an affected server.

An attacker who has already obtained a low-privileged foothold on a Windows Server with the Data Deduplication role enabled - for example via a compromised service account or a phished user session - runs a crafted local program that triggers the use-after-free in the deduplication component. By grooming kernel memory to reoccupy the freed object, the attacker corrupts kernel state and elevates to SYSTEM, taking full control of the server. No public exploit code is currently identified, so an attacker would need to develop the exploitation primitive independently.